Windows 3/5: desktop, auth, sync, and remote clients

.github/workflows/ci.yml

@@ -492,6 +492,7 @@ jobs:
       - name: Test Windows path, spawn, window, and update contracts
         run: >-
           cd apps/desktop && npx vitest run
+          src/main/services/appControl/appControlLaunchCommand.test.ts
           src/main/services/appControl/appControlService.test.ts
           src/main/services/shared/processExecution.test.ts
           src/main/services/updates/autoUpdateService.test.ts

apps/ade-cli/src/cursorCloud.ts

@@ -18,6 +18,11 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import {
+  CURSOR_WINDOWS_ARM_BLOCKER,
+  isCursorProviderSupported,
+} from "../../desktop/src/shared/providerPlatformSupport";
+
 type CursorSdk = typeof import("@cursor/sdk");
 
 const requireFromRuntime = createRequire(
@@ -42,6 +47,12 @@ function isCursorSdkResolutionError(error: unknown): boolean {
 }
 
 async function getSdk(): Promise<CursorSdk> {
+  // @cursor/sdk publishes no win32-arm64 runtime, so this import can never
+  // succeed on Windows on ARM. Fail with the reason instead of a bare
+  // ERR_MODULE_NOT_FOUND. See desktop/src/shared/providerPlatformSupport.ts.
+  if (!isCursorProviderSupported(process.platform, process.arch)) {
+    throw new Error(CURSOR_WINDOWS_ARM_BLOCKER);
+  }
   if (!sdkModulePromise) {
     sdkModulePromise = import("@cursor/sdk")
       .catch((error) => {

apps/ade-cli/src/services/credentials/credentialStore.test.ts

@@ -10,6 +10,11 @@ import {
   KeytarCredentialStore,
   createDefaultCredentialStore,
 } from "./credentialStore";
+import {
+  readOrCreateWindowsDpapiMaterial,
+  readOrCreateWindowsDpapiMaterialAsync,
+  resolveWindowsDpapiPowerShellPath,
+} from "./windowsDpapiMaterial";
 
 let tempDir = "";
 
@@ -22,6 +27,93 @@ afterEach(() => {
 });
 
 describe("EncryptedFileCredentialStore", () => {
+  it.runIf(process.platform === "win32")(
+    "resolves Windows DPAPI PowerShell through kernel SystemRoot despite poisoned environment paths",
+    () => {
+      const previousSystemRoot = process.env.SystemRoot;
+      const previousWinDir = process.env.windir;
+      process.env.SystemRoot = path.join(tempDir, "attacker-system-root");
+      process.env.windir = path.join(tempDir, "attacker-windir");
+      try {
+        const resolved = resolveWindowsDpapiPowerShellPath();
+        expect(path.win32.isAbsolute(resolved)).toBe(true);
+        expect(resolved.toLowerCase()).toMatch(
+          /\\system32\\windowspowershell\\v1\.0\\powershell\.exe$/,
+        );
+        expect(resolved.toLowerCase()).not.toContain(tempDir.toLowerCase());
+      } finally {
+        if (previousSystemRoot === undefined) delete process.env.SystemRoot;
+        else process.env.SystemRoot = previousSystemRoot;
+        if (previousWinDir === undefined) delete process.env.windir;
+        else process.env.windir = previousWinDir;
+      }
+    },
+  );
+
+  it.runIf(process.platform === "win32")(
+    "binds headless credential encryption to the current Windows account with DPAPI",
+    async () => {
+      const previousNodeEnv = process.env.NODE_ENV;
+      const previousVitest = process.env.VITEST;
+      delete process.env.NODE_ENV;
+      delete process.env.VITEST;
+      try {
+        const syncDir = path.join(tempDir, "sync-dpapi");
+        const syncMaterial = readOrCreateWindowsDpapiMaterial(syncDir);
+        const protectedKeyPath = path.join(syncDir, ".credential-key.dpapi");
+        const protectedKey = fs.readFileSync(protectedKeyPath, "utf8");
+
+        expect(syncMaterial).toHaveLength(32);
+        expect(protectedKey).toContain("ADE_WINDOWS_DPAPI_KEY_V1");
+        expect(protectedKey).not.toContain(syncMaterial.toString("base64"));
+        expect(readOrCreateWindowsDpapiMaterial(syncDir)).toEqual(syncMaterial);
+
+        const store = new EncryptedFileCredentialStore({ secretsDir: syncDir });
+        store.setSync("account.session.v1", "windows-account-session");
+        const credentialsPath = path.join(syncDir, "credentials.json.enc");
+        const machineKeyPath = path.join(syncDir, ".machine-key");
+        expect(fs.readFileSync(credentialsPath, "utf8"))
+          .not.toContain("windows-account-session");
+
+        const explicitPathReader = new EncryptedFileCredentialStore({
+          credentialsPath,
+          machineKeyPath,
+        });
+        expect(explicitPathReader.getSync("account.session.v1"))
+          .toBe("windows-account-session");
+        await expect(explicitPathReader.get("account.session.v1"))
+          .resolves.toBe("windows-account-session");
+
+        const customCredentialDir = path.join(tempDir, "custom-credential-dir");
+        const customKeyDir = path.join(tempDir, "custom-key-dir");
+        const customMachineKeyPath = path.join(customKeyDir, ".machine-key");
+        const customStore = new EncryptedFileCredentialStore({
+          secretsDir: customCredentialDir,
+          machineKeyPath: customMachineKeyPath,
+        });
+        customStore.setSync("account.session.v1", "custom-key-location");
+        expect(fs.existsSync(path.join(customKeyDir, ".credential-key.dpapi"))).toBe(true);
+        expect(fs.existsSync(path.join(customCredentialDir, ".credential-key.dpapi"))).toBe(false);
+        expect(new EncryptedFileCredentialStore({
+          credentialsPath: path.join(customCredentialDir, "credentials.json.enc"),
+          machineKeyPath: customMachineKeyPath,
+        }).getSync("account.session.v1")).toBe("custom-key-location");
+
+        const asyncDir = path.join(tempDir, "async-dpapi");
+        const asyncMaterial = await readOrCreateWindowsDpapiMaterialAsync(asyncDir);
+        expect(asyncMaterial).toHaveLength(32);
+        expect(fs.readFileSync(path.join(asyncDir, ".credential-key.dpapi"), "utf8"))
+          .not.toContain(asyncMaterial.toString("base64"));
+      } finally {
+        if (previousNodeEnv === undefined) delete process.env.NODE_ENV;
+        else process.env.NODE_ENV = previousNodeEnv;
+        if (previousVitest === undefined) delete process.env.VITEST;
+        else process.env.VITEST = previousVitest;
+      }
+    },
+    20_000,
+  );
+
   it("persists credentials encrypted on disk", async () => {
     const store = new EncryptedFileCredentialStore({ secretsDir: tempDir });
 
@@ -195,6 +287,31 @@ new EncryptedFileCredentialStore({ secretsDir }).setSync(key, value);
     expect(unbound.getSync("linear.token.v1")).toBeNull();
   });
 
+  it("atomically binds legacy Windows ciphertext on the first asynchronous credential read", async () => {
+    const legacyStore = new EncryptedFileCredentialStore({
+      secretsDir: tempDir,
+      keyMaterialProvider: () => null,
+    });
+    legacyStore.setSync("account.session.v1", "legacy-async-windows-session");
+    const credentialsPath = path.join(tempDir, "credentials.json.enc");
+    const legacyCiphertext = fs.readFileSync(credentialsPath, "utf8");
+    const osMaterial = Buffer.from("windows-async-account-bound-material");
+
+    const upgraded = new EncryptedFileCredentialStore({
+      secretsDir: tempDir,
+      keyMaterialProvider: () => {
+        throw new Error("async migration must not use synchronous key access");
+      },
+      keyMaterialProviderAsync: async () => osMaterial,
+    });
+    await expect(upgraded.get("account.session.v1")).resolves.toBe("legacy-async-windows-session");
+    expect(fs.readFileSync(credentialsPath, "utf8")).not.toBe(legacyCiphertext);
+    expect(new EncryptedFileCredentialStore({
+      secretsDir: tempDir,
+      keyMaterialProvider: () => null,
+    }).getSync("account.session.v1")).toBeNull();
+  });
+
   it("uses the asynchronous key-material path for asynchronous reads", async () => {
     const osMaterial = Buffer.from("test-os-material");
     new EncryptedFileCredentialStore({
@@ -251,23 +368,21 @@ new EncryptedFileCredentialStore({ secretsDir }).setSync(key, value);
     expect(asyncProvider).not.toHaveBeenCalled();
   });
 
-  it("can read legacy machine-key ciphertext before rewriting with OS-bound key material", async () => {
+  it("atomically binds legacy Windows ciphertext on the first synchronous credential read", () => {
     const legacy = new EncryptedFileCredentialStore({
       secretsDir: tempDir,
       keyMaterialProvider: () => null,
     });
     legacy.setSync("agent.token", "legacy_secret");
+    const credentialPath = path.join(tempDir, "credentials.json.enc");
+    const legacyCiphertext = fs.readFileSync(credentialPath, "utf8");
 
     const upgraded = new EncryptedFileCredentialStore({
       secretsDir: tempDir,
       keyMaterialProvider: () => Buffer.from("test-os-material"),
     });
     expect(upgraded.getSync("agent.token")).toBe("legacy_secret");
-    expect(legacy.getSync("agent.token")).toBe("legacy_secret");
-
-    upgraded.setSync("agent.token", "bound_secret");
-
-    expect(upgraded.getSync("agent.token")).toBe("bound_secret");
+    expect(fs.readFileSync(credentialPath, "utf8")).not.toBe(legacyCiphertext);
     expect(legacy.getSync("agent.token")).toBeNull();
   });
 

apps/ade-cli/src/services/credentials/credentialStore.ts

@@ -3,6 +3,10 @@ import { execFile, execFileSync, spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveMachineAdeLayout } from "../projects/machineLayout";
+import {
+  readOrCreateWindowsDpapiMaterial,
+  readOrCreateWindowsDpapiMaterialAsync,
+} from "./windowsDpapiMaterial";
 
 export interface CredentialStore {
   get(key: string): Promise<string | null>;
@@ -57,6 +61,10 @@ const CREDENTIAL_CHANGE_POLL_INTERVAL_MS = 250;
 const MACOS_KEYCHAIN_READ_TIMEOUT_MS = 2_000;
 const MACOS_KEYCHAIN_NEGATIVE_CACHE_MS = 30_000;
 let cachedDefaultOsBoundKeyMaterial: Buffer | null = null;
+// Keyed by resolved secrets directory: DPAPI material is protected per
+// directory, so unlike the single macOS keychain item these cannot share a slot.
+const windowsDpapiMaterialCache = new Map<string, Buffer>();
+const windowsDpapiReadInFlight = new Map<string, Promise<Buffer | null>>();
 let defaultOsBoundKeyMaterialReadInFlight: Promise<Buffer | null> | null = null;
 let lastMissingDefaultOsBoundKeyMaterialAt = 0;
 
@@ -599,11 +607,28 @@ async function readMacKeychainMaterialAsync(): Promise<Buffer | null> {
   });
 }
 
-function readDefaultOsBoundKeyMaterial(): Buffer | null {
+function readDefaultOsBoundKeyMaterial(secretsDir: string): Buffer | null {
   const envMaterial = readCredentialPassphraseFromEnv();
   if (envMaterial) return envMaterial;
   if (process.env.ADE_CREDENTIAL_STORE_DISABLE_OS_BINDING === "1") return null;
   if (process.env.VITEST === "true" || process.env.NODE_ENV === "test") return null;
+  if (process.platform === "win32") {
+    // Windows re-spawned `powershell.exe` on every credential read, where macOS
+    // spawns `security` once and caches. That is a far worse trade than it
+    // looks: PowerShell 5.1 pays CLR load, System.Security from disk, and
+    // Defender's on-access scan each time.
+    //
+    // The cache must be keyed by directory, unlike macOS. Keychain material is
+    // one global item, but DPAPI material is protected per secrets directory
+    // (`<secretsDir>/.credential-key.dpapi`), so a single shared slot would
+    // hand one store another store's key.
+    const key = path.resolve(secretsDir);
+    const cached = windowsDpapiMaterialCache.get(key);
+    if (cached) return cached;
+    const material = readOrCreateWindowsDpapiMaterial(secretsDir);
+    if (material) windowsDpapiMaterialCache.set(key, material);
+    return material;
+  }
   if (cachedDefaultOsBoundKeyMaterial) return cachedDefaultOsBoundKeyMaterial;
   const material = readOrCreateMacKeychainMaterial();
   if (material) {
@@ -613,11 +638,36 @@ function readDefaultOsBoundKeyMaterial(): Buffer | null {
   return material;
 }
 
-async function readDefaultOsBoundKeyMaterialAsync(): Promise<Buffer | null> {
+async function readDefaultOsBoundKeyMaterialAsync(secretsDir: string): Promise<Buffer | null> {
   const envMaterial = readCredentialPassphraseFromEnv();
   if (envMaterial) return envMaterial;
   if (process.env.ADE_CREDENTIAL_STORE_DISABLE_OS_BINDING === "1") return null;
   if (process.env.VITEST === "true" || process.env.NODE_ENV === "test") return null;
+  if (process.platform === "win32") {
+    const key = path.resolve(secretsDir);
+    const cached = windowsDpapiMaterialCache.get(key);
+    if (cached) return cached;
+    // In-flight dedup matters more here than it ever did on macOS: without it,
+    // concurrent credential reads each spawn their own PowerShell, and that
+    // contention is what makes a cold start slow enough to hit the timeout.
+    // No negative cache -- a locked keychain is a durable state worth backing
+    // off from, but a DPAPI failure is usually a transient timeout, and
+    // suppressing retries would make one slow cold start look permanent.
+    const pending = windowsDpapiReadInFlight.get(key);
+    if (pending) return await pending;
+    const inFlight = readOrCreateWindowsDpapiMaterialAsync(secretsDir).then((material) => {
+      if (material) windowsDpapiMaterialCache.set(key, material);
+      return material;
+    });
+    windowsDpapiReadInFlight.set(key, inFlight);
+    try {
+      return await inFlight;
+    } finally {
+      if (windowsDpapiReadInFlight.get(key) === inFlight) {
+        windowsDpapiReadInFlight.delete(key);
+      }
+    }
+  }
   if (cachedDefaultOsBoundKeyMaterial) return cachedDefaultOsBoundKeyMaterial;
   if (
     lastMissingDefaultOsBoundKeyMaterialAt > 0
@@ -675,12 +725,14 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
     const secretsDir = args.secretsDir ?? resolveMachineAdeLayout().secretsDir;
     this.credentialsPath = args.credentialsPath ?? path.join(secretsDir, DEFAULT_CREDENTIALS_FILE);
     this.machineKeyPath = args.machineKeyPath ?? path.join(secretsDir, DEFAULT_MACHINE_KEY_FILE);
+    const osBindingDir = path.dirname(this.machineKeyPath);
     this.lockPath = args.lockPath ?? defaultLockPath(this.credentialsPath);
-    this.keyMaterialProvider = args.keyMaterialProvider ?? readDefaultOsBoundKeyMaterial;
+    this.keyMaterialProvider = args.keyMaterialProvider
+      ?? (() => readDefaultOsBoundKeyMaterial(osBindingDir));
     this.keyMaterialProviderAsync = args.keyMaterialProviderAsync
       ?? (args.keyMaterialProvider
         ? async () => args.keyMaterialProvider?.() ?? null
-        : readDefaultOsBoundKeyMaterialAsync);
+        : () => readDefaultOsBoundKeyMaterialAsync(osBindingDir));
     this.credentialChangePollIntervalMs = args.credentialChangePollIntervalMs === undefined
       ? CREDENTIAL_CHANGE_POLL_INTERVAL_MS
       : args.credentialChangePollIntervalMs;
@@ -707,7 +759,9 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
 
   getSync(key: string): string | null {
     const normalized = normalizeKey(key);
-    return this.readAll({ allowRewrite: false })[normalized] ?? null;
+    return this.withLock(
+      () => this.readAll({ allowRewrite: false, migrateLegacy: true })[normalized] ?? null,
+    );
   }
 
   getLastReadState(): CredentialStoreReadState {
@@ -774,7 +828,7 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
     return this.readAll({ allowRewrite: false });
   }
 
-  private readAll(args: { allowRewrite: boolean }): Record<string, string> {
+  private readAll(args: { allowRewrite: boolean; migrateLegacy?: boolean }): Record<string, string> {
     const credentialsExist = fs.existsSync(this.credentialsPath);
     const raw = readJsonObject(this.credentialsPath);
     const machineKey = readOrCreateMachineKey(this.machineKeyPath);
@@ -797,12 +851,8 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
           throw error;
         }
         this.lastReadState = credentialsExist ? "available" : "missing";
-        if (args.allowRewrite) {
-          try {
-            this.writeAll(values);
-          } catch {
-            // Preserve read compatibility if migration cannot rewrite right now.
-          }
+        if (args.allowRewrite || args.migrateLegacy) {
+          this.writeAllWithKey(values, key);
         }
         return values;
       }
@@ -831,15 +881,25 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
       throw new Error("Unsupported ADE credential store format.");
     }
     const machineKey = await readOrCreateMachineKeyAsync(this.machineKeyPath);
-    const key = deriveOsBoundCredentialKey(machineKey, await this.keyMaterialProviderAsync());
+    const osMaterial = await this.keyMaterialProviderAsync();
+    const key = deriveOsBoundCredentialKey(machineKey, osMaterial);
     if (!key.equals(machineKey)) {
       try {
         const values = deserializeStore(raw, key, { emptyOnDecryptFailure: false });
         this.lastReadState = "available";
         return values;
       } catch {
         try {
-          const values = deserializeStore(raw, machineKey, { emptyOnDecryptFailure: false });
+          deserializeStore(raw, machineKey, { emptyOnDecryptFailure: false });
+        } catch (error) {
+          this.lastReadState = "unreadable";
+          throw error;
+        }
+        try {
+          if (!osMaterial || osMaterial.length === 0) {
+            throw new Error("OS-bound credential material is unavailable during migration.");
+          }
+          const values = this.withLock(() => this.migrateLegacyUnderLock(osMaterial));
           this.lastReadState = "available";
           return values;
         } catch (error) {
@@ -861,9 +921,26 @@ export class EncryptedFileCredentialStore implements SyncCredentialStore {
   private writeAll(values: Record<string, string>): void {
     const machineKey = readOrCreateMachineKey(this.machineKeyPath);
     const key = deriveOsBoundCredentialKey(machineKey, this.keyMaterialProvider());
+    this.writeAllWithKey(values, key);
+  }
+
+  private writeAllWithKey(values: Record<string, string>, key: Buffer): void {
     writeFileAtomic(this.credentialsPath, `${JSON.stringify(serializeStore(values, key), null, 2)}\n`);
   }
 
+  private migrateLegacyUnderLock(osMaterial: Buffer): Record<string, string> {
+    const raw = readJsonObject(this.credentialsPath);
+    const machineKey = readOrCreateMachineKey(this.machineKeyPath);
+    const key = deriveOsBoundCredentialKey(machineKey, osMaterial);
+    try {
+      return deserializeStore(raw, key, { emptyOnDecryptFailure: false });
+    } catch {
+      const values = deserializeStore(raw, machineKey, { emptyOnDecryptFailure: false });
+      this.writeAllWithKey(values, key);
+      return values;
+    }
+  }
+
   private withLock<T>(fn: () => T): T {
     return withCredentialFileLock(this.lockPath, fn);
   }